@optimystic/db-p2p 0.13.5 → 0.14.1

package/dist/src/cohort-topic/host.js

@@ -0,0 +1,1460 @@
+/**
+ * Cohort-topic FRET host (`docs/cohort-topic.md` §FRET integration L768-803).
+ *
+ * Composes the db-core substrate (participant-facing {@link CohortTopicService} + cohort-side
+ * {@link CohortMemberEngine}) over the FRET + libp2p ports and runs it as a service on one node:
+ *
+ * - registers the four `/optimystic/cohort-topic/1.0.0/*` protocols on the libp2p node;
+ * - sets FRET's activity handler so a `RouteAndMaybeAct`-routed `RegisterV1` runs the cohort decision;
+ * - binds the db-core ports to the FRET-backed adapters (router, gossip, membership, size estimator).
+ *
+ * **Per-served-coord scoping.** A topic's responsible cohort sits at `coord_0(_, topicId)` (and at
+ * `coord_d(P, topicId)` for `d ≥ 1`), which is unrelated to any node's own ring position. A node
+ * genuinely belongs to *many* cohorts — one per coord FRET routes to it — so this host keeps a lazy
+ * {@link CoordRegistry}: a `Map<servedCoord, CoordEngine>` where each {@link CoordEngine} owns the
+ * per-coord slice of state (its own store, gossip bus, willingness/traffic/renewal/cold-start, a
+ * {@link PromotionLifecycle} with coord-derived tier inputs, a {@link CohortMemberEngine}, its own
+ * {@link MembershipCertPublisher}, and its own real `k − x` threshold signer) and threshold-signs with
+ * the FRET cohort *around the served coord*. The node-wide collaborators (`hash`, `slots`, `barometer`,
+ * the FRET ports, the participant-facing service, and the verify-only verifier signer) stay singletons
+ * and are injected into each engine. The host recomputes the served coord from each decoded `RegisterV1`
+ * (`addressing.coord(treeTier, participantCoord, topicId)`), so both the activity callback and the direct
+ * `register` protocol handler dispatch to the right cohort.
+ *
+ * **Real threshold signatures.** Each coord engine assembles a genuine `k − x` cohort signature
+ * (a collected per-member Ed25519 multisig) over the new `/sign` protocol — see
+ * {@link FretCohortThresholdCrypto} — and drives a {@link MembershipCertPublisher}, so a remote
+ * `MembershipVerifier` can verify the served `MembershipCertV1` for real. Assembly needs the node's
+ * `options.privateKey`; key-less hosts compose but cannot threshold-sign (the publisher/promotion paths
+ * are simply not driven). The periodic membership refresh is exposed as the per-engine
+ * {@link CoordEngine.pumpMembership} / {@link CoordEngine.onStabilized} hooks for the gossip-cadence
+ * driver to call.
+ *
+ * **Anti-DoS + cold-start (gaps 6–7).** Each {@link CoordEngine} is injected its own per-coord anti-DoS
+ * guards — a `RegisterRateLimiter` (4/min per peer-topic), a `CorrelationReplayGuard` (60 s freshness),
+ * and a `TopicBudget` (2048 topics, LRU) — so a budget/limit at one coord is independent of another. The
+ * node-level {@link BootstrapEvidence} policy (one tier→verifier policy, no per-coord state) is built once
+ * and shared. db-core embeds no PoW / reputation scheme, so the host supplies the real verifiers
+ * ({@link createPoWVerifier} / {@link createReputationVerifier}) and the participant-side PoW minter
+ * ({@link createBootstrapEvidenceBuilder}): once configured, a node gates cold-root `bootstrap: true` at
+ * T2/T3 (PoW, or a referee reputation endorsement when offered, or a signed parent reference) and at T0/T1
+ * once a committed-existence backing is wired (a signed parent reference); a configured node with no such
+ * backing keeps T0/T1 permissive-but-logged so cold-root origination is not blocked
+ * (`cohort-topic-bootstrap-coldstart-origination-regression`), and an entirely unconfigured host stays
+ * permissive-but-logged at every tier (never an undefined gate). A cold-started tier-`d > 0` forwarder registers with
+ * its tier-`(d − 1)` parent by routing a forwarder-link frame over the router (gap 7), staying
+ * `awaiting_parent` until the ack.
+ *
+ * **Scope.** `followOn` derivation for a promoted-redirect arrival is parked in backlog
+ * (`cohort-topic-followon-derivation`); this milestone serves a **single tier-0 cohort**, so `followOn`
+ * stays `false` and tier-0 bootstrap instantiation goes through the `bootstrap: true` path. The
+ * behavioral substrate is validated at mock-tier by `test/cohort-topic/service.spec.ts` and end-to-end
+ * across a real multi-node cohort (real Ed25519 keys, mock transport routing the five protocols + FRET
+ * `routeAct`/`assembleCohort`) by `test/cohort-topic/live-tier.spec.ts`.
+ */
+import { hashPeerId, readAllBounded } from "p2p-fret";
+import { RingHash, createRegistrationStore, createSlotAssigner, createCohortGossipBus, createWillingnessCheck, createPromotionLifecycle, createColdStartManager, createTrafficCounters, createRenewalCohortSide, createMembershipVerifier, createMembershipSourceRouter, createMembershipCertPublisher, createCohortSigner, createCohortMemberEngine, createCohortTopicService, createLoadBarometer, createTierAddressing, createRegisterRateLimiter, createCorrelationReplayGuard, createTopicBudget, createBootstrapEvidence, LruMap, coreProfile, DEFAULT_MIN_SIGS, DEFAULT_MAX_NO_POW_TIER, DEFAULT_TRAFFIC_WINDOW_SECONDS, DEFAULT_TTL_MS, bytesToB64url, b64urlToBytes, bytesEqual, compareBytes, encodeCohortMessage, decodeCohortMessage, membershipCertSignable, membershipCertSigningPayload, toCohortTopicSummary, validateRegisterV1, validateRenewV1, validateSignRequestV1, validateSignReplyV1, validatePromotionNoticeV1, validateDemotionNoticeV1, registerSigningPayload, renewSigningPayload, cohortGossipSigningPayload, promotionNoticeSigningPayload, demotionNoticeSigningPayload, } from "@optimystic/db-core";
+import { randomBytes } from "@libp2p/crypto";
+import { peerIdFromString } from "@libp2p/peer-id";
+import { FretTopicRouter } from "./topic-router.js";
+import { FretCohortGossipTransport } from "./cohort-gossip-transport.js";
+import { buildCohortGossip, createPendingDeltas, DEFAULT_GOSSIP_INTERVAL_MS } from "./cohort-gossip-driver.js";
+import { FretMembershipSource } from "./membership-source.js";
+import { FretMembershipPublishSink } from "./membership-publish-sink.js";
+import { FretCohortThresholdCrypto, createVerifyOnlyThresholdCrypto } from "./threshold-crypto.js";
+import { FretTrustAnchor } from "./fret-trust-anchor.js";
+import { FretSizeEstimator } from "./size-estimator.js";
+import { peerIdToBytes, bytesToPeerIdString } from "./peer-codec.js";
+import { signPeer, verifyPeerSig } from "./peer-sig.js";
+import { createPoWVerifier, createReputationVerifier } from "./bootstrap-evidence-verifiers.js";
+import { createParentReferenceVerifier, createDefaultParentTopicView } from "./bootstrap-parent-reference.js";
+import { createBootstrapEvidenceBuilder } from "./bootstrap-evidence-builder.js";
+import { DEFAULT_COHORT_TOPIC_PROTOCOLS, cohortTopicProtocolList } from "./protocols.js";
+import { requestResponse, DEFAULT_STREAM_MAX_BYTES } from "./stream-util.js";
+import { createLogger } from "../logger.js";
+const log = createLogger("cohort-topic");
+/**
+ * Build and start a {@link CohortTopicHost} on `node` over `fret`. Registers the four protocols and
+ * sets FRET's activity handler. Async because the node's ring coordinate is derived via FRET's
+ * `hashPeerId`.
+ */
+export async function createCohortTopicHost(node, fret, options = {}) {
+    const profile = options.profile ?? coreProfile();
+    const protocols = options.protocols ?? DEFAULT_COHORT_TOPIC_PROTOCOLS;
+    const wantK = options.wantK ?? 16;
+    const minSigs = options.minSigs ?? DEFAULT_MIN_SIGS;
+    const fanout = options.fanout ?? 16;
+    const maxBytes = options.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+    const gossipIntervalMs = options.gossipIntervalMs ?? DEFAULT_GOSSIP_INTERVAL_MS;
+    const hash = new RingHash();
+    const selfPeerStr = node.peerId.toString();
+    const selfMemberBytes = peerIdToBytes(node.peerId); // dialable member id
+    const selfCoord = await hashPeerId(node.peerId); // ring position P (the participant gossip handle)
+    const addressing = createTierAddressing(hash, fanout);
+    // --- cohort resolver (FRET two-sided assembly around a coord) ---
+    const resolver = {
+        cohortPeers(coord, wants) {
+            return fret.assembleCohort(coord, wants);
+        },
+    };
+    // --- ports (node-wide singletons, injected into every coord engine) ---
+    const router = new FretTopicRouter(node, fret, { registerProtocol: protocols.register, maxBytes });
+    const sizeEstimator = new FretSizeEstimator(fret);
+    const gossipTransport = new FretCohortGossipTransport(node, resolver, { gossipProtocol: protocols.gossip, wants: wantK, selfPeerId: selfPeerStr });
+    const membershipSource = new FretMembershipSource(node, resolver, { membershipProtocol: protocols.membership, wants: wantK, maxBytes });
+    const publishSink = new FretMembershipPublishSink();
+    const slots = createSlotAssigner(hash);
+    const barometer = createLoadBarometer();
+    // Participant-side verifier signer: verify-only (it never assembles), so it needs no key / dial seam.
+    // The real k − x assembly lives in each CoordEngine's own threshold signer (constructed per coord).
+    const verifyingSigner = createCohortSigner(createVerifyOnlyThresholdCrypto(), minSigs);
+    // Collect one cohort member's `/sign` endorsement over the new fifth protocol.
+    const dialSign = async (peerIdStr, request) => {
+        const reply = await requestResponse(node, peerIdFromString(peerIdStr), protocols.sign, encodeCohortMessage(request, maxBytes), maxBytes);
+        return validateSignReplyV1(decodeCohortMessage(reply, maxBytes));
+    };
+    /** FRET assembly around `coord`: self prepended + deduped; epoch = H(sorted member join). */
+    const cohortAround = (coord) => {
+        const peerStrs = fret.assembleCohort(coord, wantK);
+        const members = [selfMemberBytes, ...peerStrs.filter((p) => p !== selfPeerStr).map((p) => peerIdToBytes(p))];
+        // Deterministic epoch from the sorted member set so a membership change rotates the epoch.
+        const epochInput = members.map(bytesToB64url).sort().join("|");
+        const cohortEpoch = hash.H(new TextEncoder().encode(epochInput));
+        return { members, cohortEpoch };
+    };
+    // --- participant peer-key signing seam (gap 2) ---
+    // The live signer needs the node's libp2p key (libp2p does not expose it off `node.peerId`, so it
+    // arrives via options). When absent we keep the interim empty-string signer AND skip inbound
+    // participant-signature verification, so key-less unit/mock flows still compose. The signer id is
+    // the participant's wire identity (`participantCoord` / `participantId`), which IS its dialable
+    // peer-id bytes (db-core threads `self = selfMemberBytes`), so it round-trips to a verifiable key.
+    const participantSigner = createParticipantSigner(options.privateKey, log);
+    const verifyRegisterSig = options.privateKey === undefined
+        ? undefined
+        : (reg) => reg.signature.length > 0 &&
+            verifyPeerSig(b64urlToBytes(reg.participantCoord), registerSigningPayload(reg), b64urlToBytes(reg.signature));
+    const verifyParticipantSig = options.privateKey === undefined
+        ? undefined
+        : (renew) => renew.signature.length > 0 &&
+            verifyPeerSig(b64urlToBytes(renew.participantId), renewSigningPayload(renew), b64urlToBytes(renew.signature));
+    // --- intra-cohort gossip authenticity seam (gap 5) ---
+    // Same peer-key signing pattern as register/renew, applied to the gossip envelope: the originator
+    // signs its canonical image, and a receiver drops a frame whose `fromMember` signature does not
+    // verify or that comes from a non-cohort member (so willingness/load can't be spoofed and forged
+    // records can't replicate). Key-less mode ships/accepts unsigned gossip (documented interim), exactly
+    // like the participant signer.
+    const nodeKey = options.privateKey;
+    const signGossip = nodeKey === undefined
+        ? undefined
+        : async (g) => bytesToB64url(await signPeer(nodeKey, cohortGossipSigningPayload(g)));
+    const verifyGossip = nodeKey === undefined
+        ? undefined
+        : (g, coord) => {
+            if (g.signature.length === 0) {
+                return false;
+            }
+            const fromBytes = b64urlToBytes(g.fromMember);
+            if (!verifyPeerSig(fromBytes, cohortGossipSigningPayload(g), b64urlToBytes(g.signature))) {
+                return false;
+            }
+            const members = cohortAround(coord).members.map(bytesToPeerIdString);
+            return members.includes(bytesToPeerIdString(fromBytes));
+        };
+    // --- outbound notice broadcast (gap 4) ---
+    // A coord engine that threshold-signs a promotion/demotion notice hands it here; we fan it over the
+    // `promote` protocol to the cohort around the served coord (siblings adopt the state) and, for a
+    // demotion, additionally to the parent coord (childCohortCount bookkeeping). Reuses the gossip
+    // transport's cohort peer resolution.
+    const broadcastNotice = (notice, servedCoord) => {
+        const frame = encodeCohortMessage(notice, maxBytes);
+        for (const coord of noticeBroadcastCoords(notice, servedCoord)) {
+            gossipTransport.broadcastOver(protocols.promote, coord, frame);
+        }
+    };
+    // --- anti-DoS (gap 6) ---
+    // The bootstrap-evidence policy is node-level (a tier→verifier policy with no per-coord state), so it
+    // is built once and shared by every coord engine. The per-coord guards (rate limiter, replay guard,
+    // topic budget) are built per CoordEngine from `antiDos` below — they key on `(peer, topic)` /
+    // per-cohort topic state, which is coord-scoped, and must not share state across coords.
+    // The signed-parent-reference existence view (cohort-topic-bootstrap-parent-reference). A test override
+    // (`antiDos.parentTopicView`) wins; otherwise the host default, tier-routed over the FRET membership
+    // cache (T2/T3) and the optional committed reader (T0/T1 — fail-closed without one, committed-tier
+    // integrity). Synchronous + local: it reads the in-memory caches the node already holds, never a dial.
+    const parentTopicView = options.antiDos?.parentTopicView ?? createDefaultParentTopicView({
+        membershipSource,
+        addressing,
+        committedReader: options.committedParentTopicReader,
+    });
+    // Does this host actually have a committed-existence backing to gate T0/T1 parent-refs against? Only an
+    // explicit `parentTopicView` override (the test seam / future production index) or a wired
+    // `committedParentTopicReader` provides one. Absent both (today's production node), a T0/T1 root cannot
+    // mint any acceptable parent-ref — a root has no parent and the default view fails T0/T1 closed — so the
+    // policy keeps T0/T1 permissive-but-logged rather than regressing cold-start origination. See
+    // {@link createBootstrapEvidencePolicy}.
+    const hasCommittedParentBacking = options.antiDos?.parentTopicView !== undefined || options.committedParentTopicReader !== undefined;
+    const bootstrapEvidence = createBootstrapEvidencePolicy(options.antiDos, hash, log, parentTopicView, hasCommittedParentBacking);
+    // Node-level `promote`-handler anti-abuse gate (`cohort-topic-promote-handler-verify-amplification`):
+    // a per-(peer, topic) rate limiter (own instance — the register-path limiter is per-coord inside each
+    // engine; this handler is node-level) plus the per-(topic, tier) effectiveAt high-water. Defaults to
+    // `register_rate_per_peer` (4 / min / peer / topic) with exponential back-off.
+    const promoteGate = createPromoteGate(options.antiDos?.rateLimiter);
+    const ctx = {
+        hash,
+        addressing,
+        slots,
+        barometer,
+        transport: gossipTransport,
+        profile,
+        selfMemberBytes,
+        wantK,
+        minSigs,
+        maxBytes,
+        publishSink,
+        privateKey: options.privateKey,
+        router,
+        antiDos: {
+            rateLimiter: options.antiDos?.rateLimiter,
+            replayGuard: options.antiDos?.replayGuard,
+            topicBudget: options.antiDos?.topicBudget,
+        },
+        bootstrapEvidence,
+        promotionConfig: options.promotion,
+        dialSign,
+        cohortAround,
+        verifyRegisterSig,
+        verifyParticipantSig,
+        signGossip,
+        verifyGossip,
+        broadcastNotice,
+        // Cache this node's own freshly-published cohort cert into the verifier, so an inbound notice
+        // signed by this node's cohort verifies locally without a network refetch. `verifier` is declared
+        // just below; the closure only runs on a (later) publish, after it is initialized.
+        onCertPublished: (cert) => verifier.cache(cert),
+    };
+    const registry = createCoordRegistry(ctx);
+    // --- intra-cohort sign endorsement (the `/sign` handler body) ---
+    // A member dials us to endorse a threshold-signed artifact; we sign the exact request payload iff we
+    // and the requester share the cohort+epoch around `coord`. Exported `handleSignRequest` is the testable
+    // core; here we bind it to this node's key + the FRET assembly around the requested coord.
+    const signEndorse = (request, fromPeerStr) => handleSignRequest(request, fromPeerStr, {
+        privateKey: options.privateKey,
+        selfMember: selfMemberBytes,
+        cohortMembersAround: (coord) => cohortAround(coord).members.map(bytesToPeerIdString),
+        currentEpoch: (coord) => cohortAround(coord).cohortEpoch,
+        // Rotation endorsement consults the served coord engine's prior-epoch membership history; a coord
+        // this node does not serve has no engine, so the hand-off is refused (no spurious instantiation).
+        priorCohortMembersAt: (coord, epoch) => registry.findByCoord(coord)?.cohortIdentityAt(epoch),
+        // Membership binding: re-derive our own canonical cert fields from the SAME `cohortAround` snapshot
+        // the per-coord publisher signs over, so a falsified `members` / `cohortCoord` / internal-epoch
+        // payload is refused. `stabilizedAt: 0` — the endorser ignores it (it only bounds the value
+        // far-future via `now`), matching the dep contract (cohort-topic-sign-endorsement-payload-binding).
+        expectedMembershipFields: (coord) => {
+            const snap = cohortAround(coord);
+            const { cohortCoord, cohortEpoch, members } = membershipCertSignable({
+                coord,
+                cohortEpoch: snap.cohortEpoch,
+                members: snap.members,
+                stabilizedAt: 0,
+            });
+            return { cohortCoord, cohortEpoch, members };
+        },
+        // Wall clock for the `stabilizedAt` far-future bound. Production: Date.now. A virtual-time harness
+        // injects a non-tripping clock (its publish `stabilizedAt` is synthetic, not wall-clock).
+        now: options.now ?? (() => Date.now()),
+    });
+    // --- participant-side composition (node scope) ---
+    // The participant service exposes a node-level gossip handle (around the node's own ring position)
+    // and the membership verifier; its register/renew walk drives the FRET router, not a coord engine.
+    const participantStore = createRegistrationStore();
+    const participantGossipBus = createCohortGossipBus({
+        transport: gossipTransport,
+        store: participantStore,
+        coord: selfCoord,
+        localEpoch: () => cohortAround(selfCoord).cohortEpoch,
+        // Same per-coord auth gate as the coord engines: only a signed gossip from a member of the cohort
+        // around the node's own ring position merges here (live-signer mode); absent in key-less composition.
+        verifyInbound: verifyGossip === undefined ? undefined : (g) => verifyGossip(g, selfCoord),
+    });
+    const certSource = membershipSource;
+    const membershipRouter = createMembershipSourceRouter({ committed: certSource, fret: certSource });
+    // --- direct trust anchor (cohort-topic-trust-anchor-fret-binding) ---
+    // Bind the db-core trust gate's direct anchor to the FRET ring: for a coord this node serves (a covered,
+    // non-partitioned T2/T3 coord whose cohort includes self), the cert's signing quorum is checked against
+    // the ring's two-sided assembly — a forged unrelated keyset is `"rejected"`, a legit (slack-tolerant)
+    // cohort `"anchored"`, everything else `"unknown"` (→ chain / TOFU). Committed tiers (T0/T1) stay
+    // `"unknown"` here so this composes with the future tx-log anchor rather than fighting it. `wantK` matches
+    // the cohort size `cohortAround` publishes certs over; `selfPeerStr` is the coverage handle.
+    const trustAnchor = new FretTrustAnchor(fret, { k: wantK, selfPeerId: selfPeerStr });
+    const verifier = createMembershipVerifier({
+        signer: verifyingSigner,
+        router: membershipRouter,
+        minSigs,
+        anchor: trustAnchor,
+        // Genesis trust roots (network-config; empty by default → no roots, identical to pre-seam behavior).
+        trustRoots: options.genesisTrustRoots ?? [],
+    });
+    // --- participant-side cold-start evidence builder (gap 6) ---
+    // Mints the evidence the participant attaches on a cold-root `bootstrap: true` re-issue. PoW (T2/T3) is
+    // keyless, so even a key-less host can bootstrap those tiers; the proof is bound to the register's own
+    // (topicId, tier, participantCoord, timestamp) tuple so a verifier reconstructs the same image. T0/T1
+    // carries no evidence here (the builder supports an `endorse` self-vouch seam — see
+    // `bootstrap-evidence-builder.ts` — but origination at those tiers is the committed-parent-reference
+    // follow-on `cohort-topic-bootstrap-parent-reference`, so it is intentionally left unwired for now).
+    const buildBootstrapEvidence = createBootstrapEvidenceBuilder({
+        hash,
+        bits: options.antiDos?.powDifficultyBits,
+    });
+    const service = createCohortTopicService({
+        // `self` is the dialable peer-id bytes (not the ring coord): db-core carries it as the
+        // participant's wire identity, so the cohort can verify its peer-key signature (see signing seam).
+        self: selfMemberBytes,
+        hash,
+        router,
+        sizeEstimator,
+        signer: participantSigner,
+        gossipBus: participantGossipBus,
+        verifier,
+        buildBootstrapEvidence,
+        config: { fanout, wantK, minSigs, maxMessageBytes: maxBytes },
+    });
+    // --- register dispatch: recompute the served coord and run the cohort decision on its engine ---
+    const dispatchRegister = async (reg, fretCohort, now) => {
+        const topicId = b64urlToBytes(reg.topicId);
+        const participantCoord = b64urlToBytes(reg.participantCoord);
+        // FRET's ActivityHandler does not carry the routed key, so recompute it from the frame. For tier
+        // `d` this equals the participant's `coord_d(self, topicId)` routing key by construction, i.e. the
+        // coordinate FRET routed to (§Tier addressing).
+        const servedCoord = addressing.coord(reg.treeTier, participantCoord, topicId);
+        const coordEngine = registry.forCoord(servedCoord, reg.treeTier, participantCoord);
+        if (fretCohort !== undefined) {
+            crossCheckCohort(fret, wantK, servedCoord, fretCohort);
+        }
+        // `parentCoord` for a cold-start forwarder's parent registration; undefined at the root.
+        const parentCoord = reg.treeTier > 0 ? addressing.coord(reg.treeTier - 1, participantCoord, topicId) : undefined;
+        return coordEngine.engine.handleRegister(reg, { followOn: false, treeTier: reg.treeTier, parentCoord }, now);
+    };
+    // --- protocol handlers + activity callback ---
+    // Await registration so the host is not returned (and dialed) before the five handlers are live —
+    // and, crucially, before the gossip driver below starts ticking (no tick may run on a half-wired node).
+    await registerProtocolHandlers(node, protocols, registry, dispatchRegister, signEndorse, verifier, promoteGate, gossipTransport, publishSink, membershipSource, selfCoord, maxBytes);
+    fret.setActivityHandler(async (activity, cohort) => {
+        const reg = validateRegisterV1(decodeCohortMessage(b64urlToBytes(activity), maxBytes));
+        const reply = await dispatchRegister(reg, cohort, Date.now());
+        return { commitCertificate: bytesToB64url(encodeCohortMessage(reply, maxBytes)) };
+    });
+    // --- periodic gossip-cadence driver (gap 5) ---
+    // db-core has no timer port (confirmed), so the host owns a single raw `setInterval`. Each tick drives
+    // every live coord engine's gossip round + membership refresh + demotion check; the membership-refresh
+    // (5 min) and demotion (5 min) hysteresis self-gate on elapsed time, so a fast tick is safe and cheap
+    // (idle empty engines build no frame). A re-entrancy guard skips a tick that overlaps a slow prior one;
+    // `stopped` short-circuits any tick that fires after `stop()`.
+    let stopped = false;
+    let ticking = false;
+    const driveTick = async () => {
+        if (stopped || ticking) {
+            return;
+        }
+        ticking = true;
+        try {
+            const now = Date.now();
+            for (const engine of registry.all()) {
+                if (stopped) {
+                    break;
+                }
+                try {
+                    await engine.gossipRound(now);
+                    await engine.pumpMembership(now);
+                    await engine.demotionTick(now);
+                }
+                catch (err) {
+                    log("cohort-topic: gossip tick failed for a coord engine: %o", err);
+                }
+            }
+            // Proactive idle reclaim of the node-level promote-gate limiter on the same cadence the per-coord
+            // limiters sweep on. The limiter's inline `maxKeys` cap is the hard worst-case bound; this sweep is
+            // the steady-state reclaim of idle `(peer, topic)` keys. Runs after the per-engine loop, inside the
+            // `ticking` guard and `stopped` short-circuit, so it is single-threaded with no race on `stop()`.
+            promoteGate.rateLimiter.sweep(now);
+        }
+        finally {
+            ticking = false;
+        }
+    };
+    const timer = setInterval(() => {
+        void driveTick();
+    }, gossipIntervalMs);
+    // Node timers keep the event loop alive; cohort gossip should not pin a process that is otherwise idle.
+    timer.unref?.();
+    return {
+        service,
+        registry,
+        protocols,
+        profile,
+        gossipTransport,
+        promoteGate,
+        stop: async () => {
+            stopped = true;
+            clearInterval(timer);
+            registry.close();
+            participantGossipBus.close();
+            await node.unhandle(cohortTopicProtocolList(protocols));
+        },
+    };
+}
+// --- participant signing seam ---
+/**
+ * The participant body signer. With a node key it peer-key-signs the canonical register/renew byte
+ * image (base64url). Without one it is the interim empty-string signer with a one-time warn that the
+ * bodies are unsigned — keeping key-less mock/unit flows composable (e.g. the four-protocol handshake
+ * test). The `signRegister`/`signRenew` bodies are the wire-payload-helper inputs verbatim.
+ */
+function createParticipantSigner(privateKey, log) {
+    if (privateKey === undefined) {
+        let warned = false;
+        const warnOnce = () => {
+            if (warned) {
+                return;
+            }
+            warned = true;
+            log("no privateKey supplied to createCohortTopicHost; participant RegisterV1/RenewV1 bodies are UNSIGNED (interim — supply options.privateKey for peer-key signing)");
+        };
+        return {
+            signRegister: () => {
+                warnOnce();
+                return Promise.resolve("");
+            },
+            signRenew: () => {
+                warnOnce();
+                return Promise.resolve("");
+            },
+        };
+    }
+    return {
+        signRegister: async (body) => bytesToB64url(await signPeer(privateKey, registerSigningPayload(body))),
+        signRenew: async (body) => bytesToB64url(await signPeer(privateKey, renewSigningPayload(body))),
+    };
+}
+// --- anti-DoS: node-level bootstrap-evidence policy (gap 6) ---
+/**
+ * Build the node-level {@link BootstrapEvidence} policy a cold root demands of a `bootstrap: true`
+ * registration (`docs/cohort-topic.md` §Anti-DoS bullet 4). The policy itself (tier-dependent: T0/T1
+ * need a signed parent reference; T2/T3 accept PoW OR reputation OR a parent reference) is real db-core
+ * logic — this only supplies the **verifiers**, which db-core deliberately does not embed (no specific
+ * PoW / reputation / committed-work scheme).
+ *
+ * Resolution per verifier (an injected `antiDos.bootstrapEvidence` override always wins — the test seam):
+ *
+ * - `verifyPoW` — when **configured**, the real {@link createPoWVerifier} (self-contained: one hash over
+ *   the bound preimage). This is a working PoW path, not deny.
+ * - `verifyReputation` — when a reputation **view** is supplied, the real {@link createReputationVerifier}
+ *   (a referee peer-key-signs the bound image; the cohort checks the signature + the referee's local
+ *   reputation). Else (configured, no view) fail closed.
+ * - `verifyParentReference` — the real {@link createParentReferenceVerifier} over `parentTopicView`: a
+ *   participant-signed reference to a parent topic that the node locally knows exists (committed/membership
+ *   state). It is the *only* accepted evidence for T0/T1 and the third T2/T3 option. The view is always
+ *   available (the host builds a default from the membership cache + addressing), so this is the real
+ *   verifier at T2/T3 and at T0/T1 **once a committed backing is wired**.
+ *
+ * **T0/T1 without a committed backing (the cold-start-origination interim posture).** A real production
+ * node wires a reputation view (so it is *configured*) but, today, no committed-existence backing
+ * (`hasCommittedParentBacking === false`): there is no coord-keyed committed-membership index yet, so the
+ * default `parentTopicView` fails T0/T1 closed, and the participant-side builder mints no parentRef for a
+ * brand-new root (a root has no parent to reference). At those tiers the policy consults *only*
+ * `verifyParentReference`, so a real, unfilled T0/T1 parent-ref gate would make cold-start origination
+ * impossible. While that backing does not exist we therefore keep T0/T1 **permissive-but-logged** when
+ * `hasCommittedParentBacking` is false, and run the real verifier otherwise — i.e. at T2/T3 always, and at
+ * T0/T1 once a committed backing IS supplied (the test seam `antiDos.parentTopicView`, or a future
+ * production `committedParentTopicReader`). This is the documented refinement of the parent-reference work,
+ * narrowed so it does not regress the just-landed real T0/T1 gating exercised with an explicit view.
+ *
+ * "Configured" = any reputation view or explicit `bootstrapEvidence` override is set; once configured, an
+ * unfilled verifier fails **closed** so a banned/low-rep referee cannot slip the T2/T3
+ * `verifyPoW || verifyReputation || verifyParentReference` disjunction. The permissive-but-logged
+ * fallback is reserved for the *entirely unconfigured* interim node (and the configured-but-no-committed-
+ * backing T0/T1 origination path above) — a one-time warning, never an undefined gate — so the
+ * db-core/mock-tier flows that bootstrap tier-0 without evidence still pass.
+ *
+ * @param hasCommittedParentBacking Whether this host has a committed-existence backing to gate T0/T1
+ *   parent-refs against (an explicit `antiDos.parentTopicView` override or a wired
+ *   `committedParentTopicReader`). False on today's production node, where T0/T1 stays permissive.
+ */
+function createBootstrapEvidencePolicy(antiDos, hash, log, parentTopicView, hasCommittedParentBacking) {
+    const overrides = antiDos?.bootstrapEvidence;
+    const reputation = antiDos?.reputation;
+    // Once ANY real gating is configured (a reputation view or explicit verifiers), an unfilled verifier
+    // must fail **closed** (deny), not open — otherwise a permissive verifier short-circuits the T2/T3
+    // `||` disjunction and admits even a banned peer. The permissive-but-logged fallback below is
+    // therefore reserved for the *entirely unconfigured* interim node.
+    const configured = overrides !== undefined || reputation !== undefined;
+    // Mirror the db-core policy's tier split (an override config wins, else the default) so the T0/T1 branch
+    // of the parent-reference gate below matches the tiers at which the policy consults it exclusively.
+    const maxNoPowTier = overrides?.config?.maxNoPowTier ?? DEFAULT_MAX_NO_POW_TIER;
+    // The real, self-contained PoW verifier — available whenever configured (no view / subsystem needed).
+    const realPoW = createPoWVerifier({ hash, bits: antiDos?.powDifficultyBits });
+    // The real referee verifier — only when a reputation view is supplied (the T2/T3 reputation path).
+    const realReputation = reputation === undefined
+        ? undefined
+        : createReputationVerifier({ reputation, deprioritizeThreshold: antiDos?.deprioritizeThreshold });
+    // The real signed-parent-reference verifier over the existence view (T2/T3 always; T0/T1 once a committed
+    // backing is wired). Replaces the interim reputation stand-in: it demands a real, existing parent.
+    const realParentReference = createParentReferenceVerifier({ parentTopicView });
+    const deny = () => false;
+    // Permissive-but-logged fallback (one warning total): keeps the gate defined while the production
+    // evidence schemes are unwired, instead of silently leaving cold-root bootstrap unauthenticated.
+    let warned = false;
+    const permissive = (kind) => (reg) => {
+        void reg;
+        if (!warned) {
+            warned = true;
+            log("cohort-topic anti-DoS: bootstrap-evidence %s verifier is PERMISSIVE — no PoW/reputation view wired, so cold-root bootstrap is NOT cryptographically gated (interim; inject antiDos.bootstrapEvidence/reputation, see cohort-topic-bootstrap-evidence-scheme)", kind);
+        }
+        return true;
+    };
+    // An unconfigured verifier: deny when the policy is otherwise configured (fail closed), else permissive.
+    const fallback = (kind) => configured ? deny : permissive(kind);
+    // The configured parent-reference gate. At T0/T1 (`reg.tier <= maxNoPowTier`) with NO committed backing,
+    // a brand-new root cannot mint any acceptable parent-ref (it has no parent; the default view fails closed)
+    // and the policy consults only this verifier there — so admit permissively-but-logged rather than regress
+    // cold-start origination. At T2/T3, and at T0/T1 once a committed backing IS wired (the test seam / future
+    // production index), run the real verifier.
+    const permissiveT0T1 = permissive("parent-reference (T0/T1, no committed backing)");
+    const parentReferenceGate = (reg) => {
+        if (reg.tier <= maxNoPowTier && !hasCommittedParentBacking) {
+            return permissiveT0T1(reg);
+        }
+        return realParentReference(reg);
+    };
+    return createBootstrapEvidence({
+        // Configured ⇒ the real PoW path; unconfigured ⇒ permissive (preserves the bare-host tier-0 flows).
+        verifyPoW: overrides?.verifyPoW ?? (configured ? realPoW : fallback("proof-of-work")),
+        verifyReputation: overrides?.verifyReputation ?? realReputation ?? fallback("reputation"),
+        // The real signed-parent-reference verifier when configured (an explicit override still wins), gated so
+        // T0/T1-without-committed-backing stays permissive; unconfigured ⇒ permissive (preserves the bare-host
+        // tier-0 flows). No longer the reputation stand-in.
+        verifyParentReference: overrides?.verifyParentReference ?? (configured ? parentReferenceGate : fallback("parent-reference")),
+        config: overrides?.config,
+    });
+}
+/**
+ * Route a forwarder→parent link to `parentCoord` and resolve on the round-trip (the parent ack).
+ *
+ * The link is a `RegisterV1`-style frame routed over {@link ITopicRouter.routeAndAct} keyed at the
+ * parent coord: it rides the parent's serving tier (`treeTier − 1`) with this engine's seed
+ * `participantCoord`, so the parent recomputes `servedCoord = coord_{d−1}(participantCoord, topicId) =
+ * parentCoord`. A fresh CSPRNG `correlationId` keeps it clear of the parent's replay guard on retry.
+ * Resolution of the route is treated as the ack (richer child-link confirmation — the parent recording
+ * `childCohortCount` over a dedicated child-link frame — is the follow-on
+ * `cohort-topic-parent-child-link`); a rejection propagates so the cold-start manager keeps the
+ * forwarder `awaiting_parent`.
+ */
+async function registerForwarderWithParent(ctx, link) {
+    const frame = {
+        v: 1,
+        topicId: bytesToB64url(link.topicId),
+        tier: clampTier(link.opTier ?? 0),
+        treeTier: Math.max(0, link.treeTier - 1),
+        participantCoord: bytesToB64url(link.participantCoord),
+        ttl: DEFAULT_TTL_MS,
+        // Not a root cold-start: a follow-on link to an already-promoted parent, so no bootstrap evidence.
+        bootstrap: false,
+        timestamp: Date.now(),
+        correlationId: bytesToB64url(randomBytes(16)),
+        // Interim: the forwarder cohort cannot sign as the participant; the dedicated child-link frame
+        // (follow-on) carries the cohort threshold signature instead.
+        signature: "",
+    };
+    await ctx.router.routeAndAct(link.parentCoord, encodeCohortMessage(frame, ctx.maxBytes), { wantK: ctx.wantK, minSigs: ctx.minSigs });
+}
+/** Clamp an op tier to the valid T0–T3 range so the link frame validates at a (future) real parent. */
+function clampTier(tier) {
+    if (!Number.isInteger(tier) || tier < 0) {
+        return 0;
+    }
+    return tier > 3 ? 3 : tier;
+}
+// --- registry + coord engine ---
+/** Build the lazy `servedCoord → CoordEngine` registry over the shared collaborators. */
+function createCoordRegistry(ctx) {
+    const engines = new Map();
+    return {
+        forCoord(coord, treeTier, participantCoord) {
+            const key = bytesToB64url(coord);
+            // Compute-if-absent, synchronously — no async gap, so two concurrent callers for the same coord
+            // share one engine rather than racing to construct a second.
+            let engine = engines.get(key);
+            if (engine === undefined) {
+                engine = createCoordEngine(ctx, coord, treeTier, participantCoord);
+                engines.set(key, engine);
+            }
+            return engine;
+        },
+        findByCoord(coord) {
+            return engines.get(bytesToB64url(coord));
+        },
+        findHolder(topicId, participantId) {
+            for (const engine of engines.values()) {
+                if (engine.holds(topicId, participantId)) {
+                    return engine;
+                }
+            }
+            return undefined;
+        },
+        findServing(topicId, treeTier) {
+            for (const engine of engines.values()) {
+                if (engine.treeTier === treeTier && engine.servesTopic(topicId)) {
+                    return engine;
+                }
+            }
+            return undefined;
+        },
+        all() {
+            return [...engines.values()];
+        },
+        close() {
+            for (const engine of engines.values()) {
+                engine.close();
+            }
+            engines.clear();
+        },
+    };
+}
+/**
+ * Per-{@link CoordEngine} epoch-rotation bookkeeping (`cohort-topic-trust-anchor-rotation-production`).
+ * Two roles, one small object:
+ *
+ * - **Producer** — {@link predecessor} is the identity of the *last published* cert; a publish whose
+ *   first `k − x` differ from it is a rotation, and the predecessor identity scopes the rotation `/sign`
+ *   round (its epoch is `prevEpoch`, its members are the outgoing cohort to collect from).
+ * - **Endorser** — {@link membersAt} answers "was I a member of the cohort at `epoch`?" over a two-deep
+ *   observed-epoch history ({@link current} + {@link prior}), kept fresh by {@link observe} on every
+ *   cohort assembly. A request for an epoch past that window is refused (the rapid-double-rotation gap).
+ *
+ * The observed history (for endorsing) is distinct from `lastPublished` (for producing): a non-deciding
+ * member endorses rotations it never published, so it cannot rely on its own publish history alone.
+ */
+class RotationState {
+    current;
+    prior;
+    lastPublished;
+    /**
+     * Record the engine's current cohort identity, shifting the previous current into {@link prior} on an
+     * epoch change. Cheap on the hot path: `build` is only invoked when `epochKey` actually changes (the
+     * member set is unchanged within an epoch, so there is nothing to refresh).
+     */
+    observe(epochKey, build) {
+        if (this.current?.epochKey === epochKey) {
+            return;
+        }
+        const next = build();
+        this.prior = this.current;
+        this.current = next;
+    }
+    /** Mark `identity` as the most recently published cert's identity (the rotation chain predecessor). */
+    recordPublished(identity) {
+        this.lastPublished = identity;
+    }
+    /** The last-published identity (the predecessor a fresh rotation attests from), or `undefined`. */
+    predecessor() {
+        return this.lastPublished;
+    }
+    /** The member peer-id strings observed under `epochKey` (current or prior), or `undefined`. */
+    membersAt(epochKey) {
+        if (this.current?.epochKey === epochKey) {
+            return this.current.memberStrs;
+        }
+        if (this.prior?.epochKey === epochKey) {
+            return this.prior.memberStrs;
+        }
+        return undefined;
+    }
+}
+/**
+ * Compose one {@link CoordEngine} bound to `servedCoord`. The cohort it threshold-signs / shards with
+ * is the FRET assembly around `servedCoord` (not the node's own ring position). The promotion tier
+ * inputs are coord-derived: `treeTier` is fixed at instantiation; `parentCoord` is
+ * `coord_{d-1}(participantCoord, topicId)` (the shard's parent shares the prefix, so any participant
+ * routed here yields the same parent); `childCohortCount` is `0` for the single-cohort milestone.
+ */
+function createCoordEngine(ctx, servedCoord, treeTier, participantCoord) {
+    const store = createRegistrationStore();
+    // Epoch-rotation bookkeeping. `cohort()` observes every assembly so the endorser history stays fresh
+    // (the gossip-cadence driver assembles each round); the producer reads `predecessor()` on publish.
+    const rotationState = new RotationState();
+    const identityOf = (view) => {
+        const memberBytes = [...view.members];
+        return {
+            epoch: view.cohortEpoch,
+            epochKey: bytesToB64url(view.cohortEpoch),
+            memberBytes,
+            memberStrs: memberBytes.map(bytesToPeerIdString),
+        };
+    };
+    const cohort = () => {
+        const view = ctx.cohortAround(servedCoord);
+        rotationState.observe(bytesToB64url(view.cohortEpoch), () => identityOf(view));
+        return view;
+    };
+    const localEpoch = () => cohort().cohortEpoch;
+    // Inbound gossip is routed to this bus by its `coord`; the optional auth gate (live-signer mode) drops
+    // a frame whose `fromMember` signature is bad or who is not a member of the cohort around THIS coord.
+    const bus = createCohortGossipBus({
+        transport: ctx.transport,
+        store,
+        coord: servedCoord,
+        localEpoch,
+        verifyInbound: ctx.verifyGossip === undefined ? undefined : (g) => ctx.verifyGossip(g, servedCoord),
+        // Sibling-drain half of the topic-budget release: a topic whose participants are sharded onto a
+        // sibling primary drains into this store as a gossip eviction (never this member's own TTL sweep),
+        // so re-`touch` the budget down from the post-delete store count — mirroring the engine's `sweepStale`
+        // re-touch. `topicBudget` is a forward `const` here, only read when this callback fires at merge time
+        // (long after both are initialized). A no-op for a topic the budget does not hold (`touch` guards it).
+        onRecordsEvicted: (topicIds) => {
+            for (const topicId of topicIds) {
+                topicBudget.touch(topicId, store.directParticipants(topicId));
+            }
+        },
+    });
+    const view = bus.view();
+    const selfMember = bytesToB64url(ctx.selfMemberBytes);
+    // Per-touch replication delta queue: the renewal cohort side appends each served touch / TTL eviction
+    // here; the next gossip round drains the batch into the broadcast frame (one round, not one per ping).
+    const pending = createPendingDeltas();
+    // Per-coord threshold signers: each assembles a real k − x signature by signing locally and collecting
+    // the rest of the cohort around THIS served coord over the `/sign` RPC. `membership` signs the cert;
+    // `promotion` signs promote/demote notices (kind drives the dialed members' endorsement policy). In
+    // key-less interim mode there is no key to sign self's chunk, so the signer is verify-only (the
+    // publisher / promotion paths are simply not driven without a key).
+    const makeCoordSigner = (kind) => {
+        if (ctx.privateKey === undefined) {
+            return createCohortSigner(createVerifyOnlyThresholdCrypto(), ctx.minSigs);
+        }
+        const crypto = new FretCohortThresholdCrypto({
+            kind,
+            privateKey: ctx.privateKey,
+            selfMember: ctx.selfMemberBytes,
+            coord: () => servedCoord,
+            cohortEpoch: localEpoch,
+            cohortMembers: () => cohort().members.map(bytesToPeerIdString),
+            dialSign: ctx.dialSign,
+        });
+        return createCohortSigner(crypto, ctx.minSigs);
+    };
+    const noticeSigner = makeCoordSigner("promotion");
+    const membershipSigner = makeCoordSigner("membership");
+    // Cohort-side membership-cert publisher: threshold-signs a MembershipCertV1 over this coord's cohort
+    // and serves it through the node's publish sink. Driven by the onStabilized / pumpMembership hooks.
+    const membershipPublisher = createMembershipCertPublisher({
+        signer: membershipSigner,
+        sink: ctx.publishSink,
+        minSigs: ctx.minSigs,
+        maxMessageBytes: ctx.maxBytes,
+    });
+    const snapshotAt = (now) => {
+        const { members, cohortEpoch } = cohort();
+        return { coord: servedCoord, cohortEpoch, members, stabilizedAt: now };
+    };
+    // Key-less interim mode has only a verify-only per-coord signer (its `assemble` rejects), so the
+    // publish hooks must no-op rather than surface a rejected promise — matching the documented
+    // "publisher paths are simply not driven without a key" contract. Without this guard a future
+    // gossip-cadence driver iterating `registry.all()` would reject on every key-less engine.
+    const canPublish = ctx.privateKey !== undefined;
+    // --- epoch-rotation attestation production (cohort-topic-trust-anchor-rotation-production) ---
+    // The first `k − x` members of the cert's ascending order; a change across a publish is a rotation
+    // (mirrors the publisher's own republish gate — same inputs, so the two agree on what is a rotation).
+    const firstKx = (members) => [...members].sort(compareBytes).slice(0, ctx.minSigs).map(bytesToB64url);
+    const firstKxChanged = (a, b) => !sameStringOrder(firstKx(a.memberBytes), firstKx(b.memberBytes));
+    /**
+     * Threshold-sign the new cert's canonical payload under the **predecessor** cohort identity, producing the
+     * `{ prevEpoch, rotationSig, rotationSigners }` attestation — or `undefined` if the predecessor quorum is
+     * unreachable (mass churn / partition), in which case the caller publishes the rotation cert WITHOUT an
+     * attestation (trust falls to the direct anchor / TOFU, no worse than a non-rotation publish). The `/sign`
+     * round is scoped to the prior epoch's members (`kind: "rotation"`), so the endorsers are the genuinely
+     * outgoing cohort. The payload is built through the SAME `membershipCertSignable` the publisher signs, so
+     * the signature image matches exactly (the db-core chain check verifies `rotationSig` over it).
+     */
+    const produceRotation = async (snapshot, predecessor) => {
+        const payload = membershipCertSigningPayload(membershipCertSignable(snapshot));
+        const selfStr = bytesToPeerIdString(ctx.selfMemberBytes);
+        const crypto = new FretCohortThresholdCrypto({
+            kind: "rotation",
+            privateKey: ctx.privateKey, // canPublish guard: rotation only runs from a publish, which no-ops key-less
+            selfMember: ctx.selfMemberBytes,
+            coord: () => servedCoord,
+            cohortEpoch: () => predecessor.epoch, // prevEpoch — scopes the endorsement to the prior epoch
+            cohortMembers: () => [...predecessor.memberStrs], // dial the OUTGOING cohort
+            dialSign: ctx.dialSign,
+            selfEligible: () => predecessor.memberStrs.includes(selfStr),
+        });
+        const signer = createCohortSigner(crypto, ctx.minSigs);
+        try {
+            const { thresholdSig, signers } = await signer.thresholdSign(payload);
+            return { prevEpoch: predecessor.epoch, rotationSig: thresholdSig, rotationSigners: signers };
+        }
+        catch (err) {
+            log("cohort-topic: rotation attestation skipped at coord %s — predecessor quorum unavailable: %o", bytesToB64url(servedCoord), err);
+            return undefined;
+        }
+    };
+    /**
+     * Publish (or refresh) this cohort's membership cert, attaching a rotation attestation when the first
+     * `k − x` changed since the last publish. `refresh` selects the publisher path: `false` for a
+     * stabilization event ({@link CoordEngine.onStabilized}), `true` for the periodic refresh
+     * ({@link CoordEngine.pumpMembership}). A first-`k − x` change is a stabilization regardless of which hook
+     * fired, so it routes through `onStabilized` (which republishes promptly on the change) carrying the
+     * attestation; the `/sign` round runs only on that change, so it costs one round per rotation, never per
+     * tick. Key-less interim mode no-ops (the verify-only signer cannot assemble).
+     */
+    const publishMembership = async (now, refresh) => {
+        if (!canPublish) {
+            return undefined;
+        }
+        const snapshot = snapshotAt(now); // also observes the current identity (snapshotAt → cohort())
+        const current = identityOf(snapshot);
+        const predecessor = rotationState.predecessor();
+        const rotating = predecessor !== undefined && firstKxChanged(predecessor, current);
+        let published;
+        if (rotating) {
+            const rotation = await produceRotation(snapshot, predecessor);
+            published = await membershipPublisher.onStabilized(snapshot, now, rotation);
+        }
+        else {
+            published = await (refresh ? membershipPublisher.tick(snapshot, now) : membershipPublisher.onStabilized(snapshot, now));
+        }
+        if (published !== undefined) {
+            rotationState.recordPublished(current);
+            ctx.onCertPublished?.(published);
+        }
+        return published;
+    };
+    const willingness = createWillingnessCheck({
+        barometer: ctx.barometer,
+        view,
+        selfMember,
+        primaryTopicCount: (tier) => countPrimaryTopics(store, ctx.selfMemberBytes, tier),
+        config: { cohortSize: ctx.wantK },
+    });
+    const traffic = createTrafficCounters({ view, store, selfMember });
+    const promotion = createPromotionLifecycle({
+        store,
+        loadBucket: (topicId) => ctx.barometer.bucket(tierOfTopic(store, topicId)),
+        // Single-cohort milestone: a tier-0 cohort with no children. Child-cohort tracking is a follow-on.
+        childCohortCount: () => 0,
+        treeTier: () => treeTier,
+        // `coord_{d-1}(P, topicId)`; never invoked at the root (demotion is gated on `treeTier > 0`), so
+        // the `d = 0` branch (clamped to `coord_0`) is a well-formed placeholder that the lifecycle skips.
+        parentCoord: (topicId) => ctx.addressing.coord(Math.max(0, treeTier - 1), participantCoord, topicId),
+        cohortEpoch: localEpoch,
+        signer: noticeSigner,
+        // Production defaults (cap_promote = 64, …) unless the host was given a promotion override — the
+        // live-tier e2e lowers `capPromote` to drive promotion with a small participant count. The
+        // coord-derived inputs above (treeTier / childCohortCount / parentCoord) are never overridden.
+        config: ctx.promotionConfig ?? { capPromote: undefined },
+    });
+    // Cold-start forwarder → parent registration (gap 7). A freshly-instantiated tier-`d > 0` forwarder
+    // registers with its tier-`(d − 1)` parent cohort at `parentCoord` so the parent counts it as a child;
+    // the ColdStartManager holds the forwarder in `awaiting_parent` (accepts participants, holds
+    // parent-involving ops) until this resolves. This supplies the TRANSPORT: route a forwarder-link frame
+    // to `parentCoord` over the same `RouteAndMaybeAct` path a participant register rides. A resolved
+    // round-trip is the parent ack (flip to `serving`); a rejected/timed-out route leaves the forwarder
+    // `awaiting_parent` for a later retry and never crashes the instantiating register (cold-start fires
+    // this fire-and-forget). The parent-side child-cohort RECORDING (`childCohortCount`, a dedicated
+    // child-link frame) is a follow-on (`tickets/backlog/cohort-topic-parent-child-link`); the
+    // single-tier-0 milestone has no parent (the root serves immediately), so a unit test exercises this.
+    const coldStart = createColdStartManager({
+        parentRegistrar: {
+            registerWithParent: (topicId, parentCoord, tier, opTier) => registerForwarderWithParent(ctx, { topicId, parentCoord, treeTier: tier, opTier, participantCoord }),
+        },
+    });
+    // Per-coord anti-DoS guards (gap 6): each CoordEngine owns its own set — a rate-limit budget / replay
+    // window / topic budget for coord A is independent of coord B. The bootstrap-evidence policy
+    // (`ctx.bootstrapEvidence`) is node-level and shared by design.
+    const rateLimiter = createRegisterRateLimiter(ctx.antiDos.rateLimiter);
+    // The read-only lookup-probe path gets its OWN per-coord rate limiter (same config, separate budget),
+    // so a probe flood cannot exhaust a participant's register budget at this coord, or vice-versa.
+    const probeRateLimiter = createRegisterRateLimiter(ctx.antiDos.rateLimiter);
+    const replayGuard = createCorrelationReplayGuard(ctx.antiDos.replayGuard);
+    const topicBudget = createTopicBudget(ctx.antiDos.topicBudget);
+    const renewal = createRenewalCohortSide({
+        store,
+        self: ctx.selfMemberBytes,
+        slots: ctx.slots,
+        cohort,
+        gossip: {
+            // Per-touch replication, batched to one gossip round: a served ping/re-attach queues the touched
+            // record; the next round drains it so cohort members converge on the active set + assignments.
+            touch: (rec) => pending.touch(rec),
+            // A TTL sweep eviction is gossiped so siblings drop the dead record (convergence on eviction).
+            evicted: (rec) => pending.evicted(rec),
+        },
+        verifyParticipantSig: ctx.verifyParticipantSig,
+    });
+    const engine = createCohortMemberEngine({
+        self: ctx.selfMemberBytes,
+        profile: ctx.profile,
+        hash: ctx.hash,
+        store,
+        slots: ctx.slots,
+        willingness,
+        promotion,
+        coldStart,
+        traffic,
+        renewal,
+        cohort,
+        quorumWilling: (tier) => ctx.profile.willingTiers.has(tier),
+        // Anti-DoS guards (gap 6): per-coord rate/replay/budget; node-level bootstrap-evidence policy.
+        rateLimiter,
+        // Dedicated probe-path rate limiter (independent budget from `rateLimiter`).
+        probeRateLimiter,
+        replayGuard,
+        topicBudget,
+        bootstrapEvidence: ctx.bootstrapEvidence,
+        verifyRegisterSig: ctx.verifyRegisterSig,
+        // Admission-time replication: enqueue the just-admitted record so siblings hold a replica before the
+        // participant's first renewal touch (closes the accept→first-touch durability window). Same queue +
+        // last-writer-wins as the renewal `gossip.touch`.
+        onAdmit: (rec) => pending.touch(rec),
+        // A promotion notice signed on an arrival is broadcast to the cohort around this served coord
+        // (and the parent for a demotion). The engine only knows the notice; the host adds the coord.
+        onNotice: (notice) => ctx.broadcastNotice?.(notice, servedCoord),
+        log,
+    });
+    /** Distinct topics this engine currently holds state for (the gossip-summary / demotion iteration set). */
+    const residentTopics = () => {
+        const byKey = new Map();
+        for (const rec of store.listAll()) {
+            byKey.set(bytesToB64url(rec.topicId), rec.topicId);
+        }
+        return [...byKey.values()];
+    };
+    // One gossip round: sweep stale records (firing the `evicted` deltas), freeze each resident topic's
+    // traffic summary, drain the touch/evicted deltas, then assemble + sign + broadcast the frame. Idle
+    // empty engines (no topics, no deltas) build no frame and skip the broadcast.
+    const gossipRound = async (now) => {
+        engine.sweepStale(now);
+        const topicSummaries = residentTopics().map((topicId) => toCohortTopicSummary(topicId, traffic.publish(topicId, now), {
+            tier: tierOfTopic(store, topicId),
+            directParticipants: store.directParticipants(topicId),
+            promoted: promotion.isPromoted(topicId),
+            // Single-cohort milestone: no child cohorts tracked. Child-cohort tracking is a follow-on.
+            childCohortCount: 0,
+        }));
+        const { records, evicted } = pending.drain();
+        const g = buildCohortGossip({
+            fromMember: selfMember,
+            coord: bytesToB64url(servedCoord),
+            cohortEpoch: bytesToB64url(localEpoch()),
+            profile: ctx.profile,
+            barometer: ctx.barometer,
+            windowSeconds: DEFAULT_TRAFFIC_WINDOW_SECONDS,
+            topicSummaries,
+            records,
+            evicted,
+            timestamp: now,
+        });
+        if (g === undefined) {
+            return undefined;
+        }
+        if (ctx.signGossip !== undefined) {
+            g.signature = await ctx.signGossip(g);
+        }
+        bus.broadcast(g);
+        return g;
+    };
+    // Time-driven demotion across resident topics; any returned notice is broadcast to the cohort (and the
+    // parent coord) via the same path a promotion uses. Skipped without a key (verify-only signer can't
+    // assemble); for the single-cohort tier-0 milestone the lifecycle never demotes (the root has no parent).
+    const demotionTick = async (now) => {
+        if (!canPublish) {
+            return;
+        }
+        for (const topicId of residentTopics()) {
+            let notice;
+            try {
+                notice = await promotion.maybeDemote(topicId, now);
+            }
+            catch (err) {
+                log("cohort-topic: demotion sign/broadcast failed for topic %s: %o", bytesToB64url(topicId), err);
+                continue;
+            }
+            if (notice !== undefined) {
+                ctx.broadcastNotice?.(notice, servedCoord);
+            }
+        }
+    };
+    return {
+        servedCoord,
+        treeTier,
+        engine,
+        cohort,
+        cohortIdentityAt: (epoch) => rotationState.membersAt(bytesToB64url(epoch)),
+        hasState: () => store.listAll().length > 0,
+        holds: (topicId, participantId) => store.getByParticipant(topicId, participantId) !== undefined,
+        records: (topicId) => store.listByTopic(topicId),
+        topicTraffic: (topicId) => traffic.snapshot(topicId),
+        cohortView: () => view,
+        servesTopic: (topicId) => store.directParticipants(topicId) > 0 || coldStart.get(topicId) !== undefined,
+        budgetHasTopic: (topicId) => topicBudget.has(topicId),
+        budgetParticipantCount: (topicId) => topicBudget.participantCount(topicId),
+        forwarder: (topicId) => coldStart.get(topicId),
+        isPromoted: (topicId) => promotion.isPromoted(topicId),
+        applyPromotionNotice: (notice, now) => promotion.applyPromotionNotice(notice, now),
+        applyDemotionNotice: (notice, now) => promotion.applyDemotionNotice(notice, now),
+        onStabilized: (now) => publishMembership(now, false),
+        pumpMembership: (now) => publishMembership(now, true),
+        gossipRound,
+        demotionTick,
+        close: () => bus.close(),
+    };
+}
+/**
+ * Resolve an inbound `RenewV1` to the coord engine holding its record and run the renewal. A `RenewV1`
+ * carries no `treeTier`, so the held record — not a recomputed coord — names the cohort. If no engine
+ * on this host holds it (cross-node renewal, post-restart eviction, or replication lag), reply
+ * `unknown_registration` so the participant's failover loop tries its backups and ultimately re-runs
+ * the `d_max` lookup (§TTL and renewal) — never throw.
+ */
+export function resolveRenew(registry, renew, now) {
+    const topicId = b64urlToBytes(renew.topicId);
+    const participantId = b64urlToBytes(renew.participantId);
+    const holder = registry.findHolder(topicId, participantId);
+    if (holder === undefined) {
+        return { v: 1, result: "unknown_registration" };
+    }
+    return holder.engine.handleRenew(renew, now);
+}
+/** Tolerated future skew (ms) for a `membership` payload's `stabilizedAt` — a value beyond this is refused. */
+const SIGN_STABILIZED_AT_SKEW_MS = 5_000;
+/** The canonical signable-image tag a non-`rotation` {@link SignKind} must carry (binds tag ↔ kind). */
+const SIGNABLE_IMAGE_TAG = {
+    membership: "MembershipCertV1",
+    promotion: "PromotionNoticeV1",
+    demotion: "DemotionNoticeV1",
+};
+/**
+ * Decode a `/sign` payload's canonical signable array image — `utf8(JSON.stringify([...]))` produced by
+ * `sig/payloads.ts`. Returns the decoded array, or `undefined` when the bytes are not base64url of a JSON
+ * array. NOTE: the payload is a raw signable image, **not** a `CohortMessageV1`, so it is decoded with
+ * `JSON.parse`, never `decodeCohortMessage`.
+ */
+function decodeSignableImage(payloadB64) {
+    try {
+        const decoded = JSON.parse(new TextDecoder().decode(b64urlToBytes(payloadB64)));
+        return Array.isArray(decoded) ? decoded : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Deep-equal of an unknown payload field against the endorser's own ascending-sorted base64url member
+ * list. Guards the `unknown` (a non-array payload field → not a match) before delegating to the shared
+ * ordered-string-array equality; element-wise `!==` makes a non-string entry a mismatch.
+ */
+function sameMemberList(image, expected) {
+    return Array.isArray(image) && sameStringOrder(image, expected);
+}
+/**
+ * The `/sign` endorsement policy: decide whether to endorse a {@link SignRequestV1} and, if so, return
+ * this node's Ed25519 peer-key signature over the **exact** request payload. A member endorses only when
+ * both it and the requester are members of the cohort around `coord` under the request's epoch, **and**
+ * the payload bytes re-derive to something this node independently agrees to attest — so it never signs
+ * for outsiders and never blindly signs requester-supplied bytes. It still signs the exact image (no
+ * re-canonicalization), so the assembled signature verifies against what the requester collected.
+ *
+ * **Payload binding (cohort-topic-sign-endorsement-payload-binding).** The cohort + wire-epoch gates never
+ * inspect `request.payload`; without binding it an insider could collect honest signatures over a cert the
+ * cohort never agreed to. After those gates the endorser decodes the canonical signable image
+ * (`sig/payloads.ts` — a `JSON.parse`d array, NOT a `CohortMessageV1`) and refuses unless:
+ *
+ * - **all kinds** — the image tag matches the kind (`membership`→`MembershipCertV1`, etc.) and the
+ *   payload-internal `cohortEpoch` equals this node's current epoch for `coord`; and
+ * - **`membership`** — `cohortCoord`, the full `members` list (deep-equal to the endorser's own ascending
+ *   re-derived set), and a finite, not-far-future `stabilizedAt` all match its independent view
+ *   ({@link SignEndorsementDeps.expectedMembershipFields}). Because epoch = H(members) in this host, the
+ *   members and internal-epoch checks are mutually reinforcing: a forged member list cannot also carry the
+ *   honest epoch. The participant verifier still independently re-checks `signers ⊆ cert.members`.
+ *
+ * The kind-specific **hot/cold** refinement for `promotion` / `demotion` (the endorser additionally
+ * requiring its own replicated `directParticipants` to be hot / cold) remains deferred: it needs a
+ * per-topic binding the `(payload, minSigs)` port can't carry and gossip record replication that is still
+ * interim. Parked in `cohort-topic-sign-endorsement-hotcold-refinement` (backlog).
+ *
+ * **`"rotation"` (epoch hand-off).** A rotation request carries the **prior** epoch as `cohortEpoch` and
+ * asks the outgoing cohort to sign the *successor* cert. The gate therefore checks **prior**-epoch
+ * membership instead of current: the endorser must have served the cohort at `prevEpoch`, and the
+ * requester must have been a member of that prior cohort too (the genuinely outgoing set). The verifier
+ * still independently re-checks `rotationSigners ⊆ predecessor-cert.members`, so this gate is the
+ * load-shedding sanity check, not the trust root. See `cohort-topic-trust-anchor-rotation-production`.
+ */
+export async function handleSignRequest(request, fromPeerStr, deps) {
+    if (deps.privateKey === undefined) {
+        return { v: 1, refused: true, reason: "node has no signing key" };
+    }
+    const coord = b64urlToBytes(request.coord);
+    const selfStr = bytesToPeerIdString(deps.selfMember);
+    if (request.kind === "rotation") {
+        // Prior-epoch gate: endorse a hand-off only from an epoch THIS node was a member of, and only for a
+        // requester that was a member of that same prior cohort. `request.cohortEpoch` IS the prevEpoch.
+        const prevEpoch = b64urlToBytes(request.cohortEpoch);
+        const priorMembers = deps.priorCohortMembersAt?.(coord, prevEpoch);
+        if (priorMembers === undefined) {
+            return { v: 1, refused: true, reason: "not a member of the prior cohort at prevEpoch" };
+        }
+        if (!priorMembers.includes(selfStr)) {
+            return { v: 1, refused: true, reason: "self not in the prior cohort" };
+        }
+        if (!priorMembers.includes(fromPeerStr)) {
+            return { v: 1, refused: true, reason: "requester not in the prior cohort" };
+        }
+        // Structural sanity only: a rotation carries the SUCCESSOR cert image. Full successor re-derivation is
+        // out of scope here (the endorser is the OUTGOING cohort and may not know the successor member set), so
+        // the prior-epoch gate stays the trust check — but reject a payload that is not even a MembershipCertV1
+        // image so the gate cannot be tricked into signing junk bytes. See the rotation follow-on note.
+        const rotImage = decodeSignableImage(request.payload);
+        if (rotImage === undefined || rotImage[0] !== SIGNABLE_IMAGE_TAG.membership) {
+            return { v: 1, refused: true, reason: "rotation payload is not a MembershipCertV1 image" };
+        }
+        const signature = await signPeer(deps.privateKey, b64urlToBytes(request.payload));
+        return { v: 1, signer: bytesToB64url(deps.selfMember), signature: bytesToB64url(signature) };
+    }
+    const members = deps.cohortMembersAround(coord);
+    if (!members.includes(selfStr)) {
+        return { v: 1, refused: true, reason: "not a cohort member for coord" };
+    }
+    if (!members.includes(fromPeerStr)) {
+        return { v: 1, refused: true, reason: "requester not in cohort" };
+    }
+    if (!bytesEqual(b64urlToBytes(request.cohortEpoch), deps.currentEpoch(coord))) {
+        return { v: 1, refused: true, reason: "cohort epoch mismatch" };
+    }
+    // --- payload binding: re-derive what we are willing to attest and refuse anything that does not match ---
+    // The wire-field gates above never inspect `request.payload`; without this an insider could collect honest
+    // signatures over a cert the cohort never agreed to (falsified members / kind-mismatched bytes).
+    const image = decodeSignableImage(request.payload);
+    if (image === undefined) {
+        return { v: 1, refused: true, reason: "payload is not a decodable signable image" };
+    }
+    // All kinds — bind tag ↔ kind (a `membership` request must carry a MembershipCertV1 image, closing the
+    // kind-mismatch hole where a kind-agnostic threshold blob verifies for whatever the bytes decode to).
+    const expectedTag = SIGNABLE_IMAGE_TAG[request.kind];
+    if (image[0] !== expectedTag) {
+        return { v: 1, refused: true, reason: `payload kind tag mismatch (expected ${expectedTag})` };
+    }
+    // All kinds — bind the payload-internal `cohortEpoch` to our own current epoch (closes the falsified-internal
+    // -epoch hole, for promotion / demotion too). It is `image[2]` for a MembershipCertV1 image and the last
+    // element for promotion / demotion (see `sig/payloads.ts`).
+    const currentEpochB64 = bytesToB64url(deps.currentEpoch(coord));
+    const embeddedEpoch = request.kind === "membership" ? image[2] : image[image.length - 1];
+    if (embeddedEpoch !== currentEpochB64) {
+        return { v: 1, refused: true, reason: "payload cohortEpoch does not match endorser view" };
+    }
+    if (request.kind === "membership") {
+        // The core fix: bind coord + members + stabilizedAt to the endorser's independently re-derived view.
+        // Because epoch = H(members) in this host, a forged member list cannot also carry the honest epoch — the
+        // embedded-epoch gate above and this members gate are mutually reinforcing.
+        const expected = deps.expectedMembershipFields?.(coord);
+        if (expected === undefined) {
+            return { v: 1, refused: true, reason: "no membership view to bind the cert against" };
+        }
+        if (image[1] !== expected.cohortCoord) {
+            return { v: 1, refused: true, reason: "payload cohortCoord does not match endorser view" };
+        }
+        if (!sameMemberList(image[3], expected.members)) {
+            return { v: 1, refused: true, reason: "payload members do not match endorser view" };
+        }
+        const stabilizedAt = image[4];
+        if (typeof stabilizedAt !== "number" || !Number.isFinite(stabilizedAt)) {
+            return { v: 1, refused: true, reason: "payload stabilizedAt is not a finite number" };
+        }
+        if (deps.now !== undefined && stabilizedAt > deps.now() + SIGN_STABILIZED_AT_SKEW_MS) {
+            return { v: 1, refused: true, reason: "payload stabilizedAt is far-future" };
+        }
+    }
+    const signature = await signPeer(deps.privateKey, b64urlToBytes(request.payload));
+    return { v: 1, signer: bytesToB64url(deps.selfMember), signature: bytesToB64url(signature) };
+}
+/**
+ * Hard cap on tracked `(topicId, tier)` high-water entries; the least-recently-touched are evicted beyond
+ * this. A modest bound is plenty — only verified applies grow the map, so it never evicts under legitimate
+ * load — but it caps the otherwise retain-forever shape on a long-lived node.
+ */
+export const PROMOTE_HIGHWATER_MAX_KEYS = 8192;
+/** Build the default {@link PromoteGate} from the (optional) anti-DoS rate-limiter config. */
+export function createPromoteGate(rateLimiterConfig) {
+    return { rateLimiter: createRegisterRateLimiter(rateLimiterConfig), highWater: new LruMap(PROMOTE_HIGHWATER_MAX_KEYS) };
+}
+/**
+ * Decode a `promote`-protocol frame as a {@link PromotionNoticeV1} or {@link DemotionNoticeV1} (try one,
+ * then the other), or `undefined` if it is neither. The two shapes are disjoint — a promotion carries
+ * `fromTier`/`toTier`, a demotion carries `parentCohortCoord` — so the structural validators cleanly
+ * discriminate.
+ */
+export function decodeInboundNotice(frame, maxBytes) {
+    const decoded = decodeCohortMessage(frame, maxBytes);
+    const promotion = tryValidate(() => validatePromotionNoticeV1(decoded));
+    if (promotion !== undefined) {
+        return { kind: "promotion", notice: promotion };
+    }
+    const demotion = tryValidate(() => validateDemotionNoticeV1(decoded));
+    if (demotion !== undefined) {
+        return { kind: "demotion", notice: demotion };
+    }
+    return undefined;
+}
+/**
+ * Per-coord minimum interval (ms) between membership refetches on the inbound `promote` path. Caps the
+ * amplification a flood of forged notices can drive: a stream of verify-misses triggers at most one
+ * `source.fetch()` per coord per this window, while a cold cache / membership rotation still re-fetches
+ * once it elapses (eventual refetch preserved). 60 s mirrors the anti-DoS rate window.
+ */
+export const PROMOTE_REFETCH_MIN_INTERVAL_MS = 60_000;
+/**
+ * Verify an inbound notice's threshold signature against the cohort `MembershipCertV1` for
+ * `target.servedCoord` and, on success, apply it to the target's promotion lifecycle. Returns:
+ *
+ * - `"dropped"`  — no local engine serves the notice's `(topic, tier)` (e.g. a demotion arriving at a
+ *   parent that does not track the child); nothing to apply to.
+ * - `"untrusted"` — the `signers` are not a `≥ minSigs` subset of the cohort cert, or the multisig does
+ *   not verify (a forged single-signer / short-quorum notice); local state is left unchanged.
+ * - `"applied"`  — verified and applied.
+ *
+ * The payload is rebuilt with the canonical `sig/payloads` image the signer used — never re-canonicalized
+ * independently. The verifier owns the cert lookup; this function never re-verifies inside the apply step
+ * (db-core trusts this gate).
+ *
+ * **Bounded refetch (anti-amplification).** Both verify calls pass a {@link PROMOTE_REFETCH_MIN_INTERVAL_MS}
+ * refetch bound, so a stream of forged notices drives at most **one** membership `source.fetch()` per coord
+ * per interval rather than one dial per message. Eventual refetch is preserved (full suppression was
+ * rejected: a legitimate sibling-adopt / demotion-to-parent notice whose cohort cert is not yet locally
+ * cached must still be able to fetch it once — see `live-tier.spec.ts` test 4). A node that has cached its
+ * own cohort cert via `onCertPublished` verifies a sibling-adopt notice from cache with zero fetches; a
+ * cold-cache receiver pays one bounded fetch. Per `cohort-topic-promote-handler-verify-amplification`.
+ */
+export async function verifyAndApplyNotice(inbound, target, verifier, now) {
+    if (target === undefined) {
+        return "dropped";
+    }
+    let signers;
+    let sig;
+    try {
+        signers = inbound.notice.signers.map(b64urlToBytes);
+        sig = b64urlToBytes(inbound.notice.thresholdSig);
+    }
+    catch {
+        return "untrusted"; // a signer / sig that is not valid base64url cannot verify
+    }
+    // Narrow on `inbound` (not a destructured `notice`) so the tier field and apply hook are typed per kind.
+    if (inbound.kind === "promotion") {
+        const payload = promotionNoticeSigningPayload(inbound.notice);
+        const result = await verifier.verifyMessage(signers, target.servedCoord, inbound.notice.fromTier, payload, sig, { minRefetchIntervalMs: PROMOTE_REFETCH_MIN_INTERVAL_MS, now });
+        if (result !== "verified") {
+            return "untrusted";
+        }
+        target.applyPromotionNotice(inbound.notice, now);
+        return "applied";
+    }
+    const payload = demotionNoticeSigningPayload(inbound.notice);
+    const result = await verifier.verifyMessage(signers, target.servedCoord, inbound.notice.tier, payload, sig, { minRefetchIntervalMs: PROMOTE_REFETCH_MIN_INTERVAL_MS, now });
+    if (result !== "verified") {
+        return "untrusted";
+    }
+    target.applyDemotionNotice(inbound.notice, now);
+    return "applied";
+}
+/**
+ * Full inbound `promote`-frame pipeline with the anti-abuse gate, exported so it is unit-testable without a
+ * live node (`cohort-topic-promote-handler-verify-amplification`). Runs the cheapest checks first — each
+ * step strictly cheaper than the next — so a flood of forged frames is shed before any signature / network
+ * work:
+ *
+ * ```
+ *   decode → per-(peer,topic) rate limit → findServing → effectiveAt high-water → verify+apply
+ * ```
+ *
+ * - **Rate limit** (`gate.rateLimiter`) keys on `(from, topicId)`; an over-rate peer is dropped before the
+ *   `findServing` map scan and the verify, so a peer cannot amplify junk into verify/network work.
+ * - **High-water** (`gate.highWater`, per `(topicId, tier)`) drops a notice whose `effectiveAt` is at or
+ *   below the last *applied* one — a replay / out-of-order frame — before `verifyMessage`. It is advanced
+ *   **only** on an `"applied"` outcome, so a forged frame (which never verifies) cannot poison it.
+ * - The receiver-side `cohortEpoch` is intentionally **not** gated on: the epoch rotates on every
+ *   membership change, so a legitimately in-flight notice can briefly carry the prior epoch right after a
+ *   rotation — making an epoch check a brittle, false-positive-prone filter. The rate limiter + high-water
+ *   are the load-bearing defenses; the bounded refetch (in {@link verifyAndApplyNotice}) caps the network
+ *   amplification on the verify itself.
+ *
+ * `from` is the dialing peer's substrate bytes ({@link peerIdToBytes}); the node handler converts the
+ * libp2p `PeerId` before calling. One-way contract: the caller sends no ack regardless of outcome.
+ */
+export async function handleInboundNotice(frame, from, registry, verifier, gate, now, maxBytes) {
+    const inbound = decodeInboundNotice(frame, maxBytes);
+    if (inbound === undefined) {
+        log("promote: dropped an undecodable notice frame");
+        return "undecodable";
+    }
+    const tier = inbound.kind === "promotion" ? inbound.notice.fromTier : inbound.notice.tier;
+    const topicId = b64urlToBytes(inbound.notice.topicId);
+    // Per-(peer, topic) rate limit — before the findServing scan and the verify.
+    if (gate.rateLimiter.check(from, topicId, now).ok === false) {
+        log("promote: rate-limited %s notice for topic %s tier %d", inbound.kind, inbound.notice.topicId, tier);
+        return "rate-limited";
+    }
+    const target = registry.findServing(topicId, tier);
+    if (target === undefined) {
+        log("promote: dropped %s notice for topic %s tier %d (no serving engine)", inbound.kind, inbound.notice.topicId, tier);
+        return "dropped";
+    }
+    // Freshness / replay gate: drop an at-or-below-high-water notice before the expensive verify.
+    const waterKey = `${inbound.notice.topicId}|${tier}`;
+    const water = gate.highWater.get(waterKey);
+    if (water !== undefined && inbound.notice.effectiveAt <= water) {
+        log("promote: stale %s notice for topic %s tier %d (effectiveAt %d <= high-water %d)", inbound.kind, inbound.notice.topicId, tier, inbound.notice.effectiveAt, water);
+        return "stale";
+    }
+    const outcome = await verifyAndApplyNotice(inbound, target, verifier, now);
+    if (outcome === "applied") {
+        // Advance the high-water only on a *verified-and-applied* notice, so a forged frame cannot poison it.
+        gate.highWater.set(waterKey, inbound.notice.effectiveAt);
+    }
+    else {
+        log("promote: %s %s notice for topic %s tier %d", outcome, inbound.kind, inbound.notice.topicId, tier);
+    }
+    return outcome;
+}
+/**
+ * The cohort coords a notice is broadcast to over the `promote` protocol: always the cohort around
+ * `servedCoord` (siblings adopt the state); for a demotion, additionally the parent cohort coord (so the
+ * parent's `childCohortCount` bookkeeping converges). Pure — exported for testing the fan-out targets.
+ */
+export function noticeBroadcastCoords(notice, servedCoord) {
+    if ("parentCohortCoord" in notice) {
+        return [servedCoord, b64urlToBytes(notice.parentCohortCoord)];
+    }
+    return [servedCoord];
+}
+// --- helpers ---
+/**
+ * Cross-check the cohort FRET routed the activity to against the locally recomputed assembly around
+ * `servedCoord`. A mismatch (a slightly stale routing table) is logged; the recomputed assembly is
+ * trusted, so renewal / gossip / signing — which run outside the activity callback — stay consistent.
+ */
+function crossCheckCohort(fret, wantK, servedCoord, fretCohort) {
+    const assembled = fret.assembleCohort(servedCoord, wantK);
+    if (!sameMemberSet(fretCohort, assembled)) {
+        log("cohort cross-check mismatch at coord %s: FRET-routed=%o assembled=%o; trusting the recomputed assembly", bytesToB64url(servedCoord), fretCohort, assembled);
+    }
+}
+/** Positional equality over two string lists (the first-`k − x` rotation-change check). */
+function sameStringOrder(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    for (let i = 0; i < a.length; i++) {
+        if (a[i] !== b[i]) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Set equality over two peer-id-string lists (order-independent). */
+function sameMemberSet(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    const seen = new Set(a);
+    return b.every((m) => seen.has(m));
+}
+/** Count topics this member is currently `primary` for at `tier` (the willingness budget input). */
+function countPrimaryTopics(store, self, tier) {
+    const seen = new Set();
+    for (const rec of store.listAll()) {
+        if (rec.tier === tier && bytesToB64url(rec.primary) === bytesToB64url(self)) {
+            seen.add(bytesToB64url(rec.topicId));
+        }
+    }
+    return seen.size;
+}
+/** Resolve a topic's op tier from any held record (0 if none yet). */
+function tierOfTopic(store, topicId) {
+    const recs = store.listByTopic(topicId);
+    return (recs.length > 0 ? recs[0].tier : 0);
+}
+async function registerProtocolHandlers(node, protocols, registry, dispatchRegister, signEndorse, verifier, promoteGate, gossipTransport, publishSink, membershipSource, selfCoord, maxBytes) {
+    await Promise.all([
+        // register: a direct dial carries either a RegisterV1 (re-attach walk fallback) or a RenewV1 (ping).
+        node.handle(protocols.register, makeFrameHandler(async (frame) => {
+            const decoded = decodeCohortMessage(frame, maxBytes);
+            const renew = tryValidate(() => validateRenewV1(decoded));
+            if (renew !== undefined) {
+                return encodeCohortMessage(resolveRenew(registry, renew, Date.now()), maxBytes);
+            }
+            const reg = validateRegisterV1(decoded);
+            // Direct dial (not FRET-routed): no cohort member list to cross-check against.
+            const reply = await dispatchRegister(reg, undefined, Date.now());
+            return encodeCohortMessage(reply, maxBytes);
+        }, maxBytes)),
+        // cohort-gossip: feed inbound gossip into the shared transport (one-way). It fans the frame to
+        // every coord engine's bus; per-bus epoch matching governs which engine merges the record deltas.
+        node.handle(protocols.gossip, makeFrameHandler(async (frame, from) => {
+            gossipTransport.deliver(from.toString(), frame);
+            return undefined;
+        }, maxBytes)),
+        // promote: threshold-signed promotion/demotion notices (one-way, gossip-style fan-out). The dialing
+        // peer arrives as `from`, so the handler can gate per-(peer, topic) before any expensive work. The
+        // full pipeline (rate limit → findServing → effectiveAt high-water → verify+apply, bounded
+        // refetch) lives in the exported `handleInboundNotice`; it logs and never throws on the stream.
+        node.handle(protocols.promote, makeFrameHandler(async (frame, from) => {
+            await handleInboundNotice(frame, peerIdToBytes(from), registry, verifier, promoteGate, Date.now(), maxBytes);
+            return undefined; // one-way: match the gossip-style fan-out (no ack frame)
+        }, maxBytes)),
+        // membership: serve this node's latest published cert; cache any cert the requester returns.
+        node.handle(protocols.membership, makeFrameHandler(async (frame) => {
+            void frame; // request frame is the raw coord; this node serves its own cohort cert
+            const latest = publishSink.latest();
+            if (latest !== undefined) {
+                membershipSource.cache(selfCoord, latest);
+            }
+            return latest ?? new Uint8Array(0);
+        }, maxBytes)),
+        // sign: per-member endorsement for threshold-signature assembly. Validate the request, run the
+        // endorsement policy, and reply with this node's peer-key signature over the request payload (or a
+        // refusal). One Ed25519 sign and nothing more — the cohort + epoch gate bounds who we sign for.
+        node.handle(protocols.sign, makeFrameHandler(async (frame, from) => {
+            const request = validateSignRequestV1(decodeCohortMessage(frame, maxBytes));
+            const reply = await signEndorse(request, from.toString());
+            return encodeCohortMessage(reply, maxBytes);
+        }, maxBytes)),
+    ]);
+}
+/** Wrap a frame handler in the read-one / reply-one libp2p stream lifecycle. */
+function makeFrameHandler(handle, maxBytes) {
+    return (stream, connection) => {
+        void (async () => {
+            try {
+                const frame = await readAllBounded(stream, maxBytes);
+                const reply = await handle(frame, connection.remotePeer);
+                if (reply !== undefined) {
+                    stream.send(reply);
+                }
+                await stream.close();
+            }
+            catch {
+                try {
+                    stream.abort(new Error("cohort-topic handler error"));
+                }
+                catch {
+                    /* already aborted */
+                }
+            }
+        })();
+    };
+}
+/** Run `fn`, returning `undefined` if it throws (used to try one validator then fall through). */
+function tryValidate(fn) {
+    try {
+        return fn();
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=host.js.map